diff options
| author | Varun Reddy Yeturu <varunreddy.yeturu@codeaurora.org> | 2017-10-03 17:11:19 -0700 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2017-10-06 11:53:43 -0700 |
| commit | dd8dd999410a4c447567161129838c19180104ea (patch) | |
| tree | 5db7a58f421a9e11396cf5344b4bf00073731126 /core/wma/src/wma_mgmt.c | |
| parent | c0a07c14587909e9248ccb3bad084f647e199a93 (diff) | |
| download | qcacld-dd8dd999410a4c447567161129838c19180104ea.tar.gz | |
qcacld-3.0: Avoid overflow of WMI descriptor pool array
Ensure that the array index of WMI descriptor pool is
within the maximum pool size
Change-Id: I32bf6a9689d3119369cfe2284f51f6592aa00047
CRs-Fixed: 2119803
Diffstat (limited to 'core/wma/src/wma_mgmt.c')
| -rw-r--r-- | core/wma/src/wma_mgmt.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/core/wma/src/wma_mgmt.c b/core/wma/src/wma_mgmt.c index d96a636d4b..037e526ebc 100644 --- a/core/wma/src/wma_mgmt.c +++ b/core/wma/src/wma_mgmt.c @@ -2718,6 +2718,10 @@ static int wma_process_mgmt_tx_completion(tp_wma_handle wma_handle, WMA_LOGE("%s: NULL pdev pointer", __func__); return -EINVAL; } + if (desc_id >= WMI_DESC_POOL_MAX) { + WMA_LOGE("%s: Invalid desc id %d", __func__, desc_id); + return -EINVAL; + } WMA_LOGD("%s: status: %s wmi_desc_id: %d", __func__, wma_get_status_str(status), desc_id); |